How does the centralized ad server track the user as they move from site A to site B, since no cross-domain cookies can be used? Without resorting to fingerprinting which could be circumvented by the client. Absent behavioral profiles and persistent tracking, most ad formats are worth very little. Isn’t limiting all communication to the first party domain a form of sandboxing?